CVE-2005-4454
LiveJournal cleanhtml.pl < 1.129 - Cross-Site Scripting via Backslash Bypass in CSS Style Property
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2005-4454. PoCs published by Andrew Farmer.
AI-analyzed exploit summary This exploit demonstrates an HTML injection vulnerability in LiveJournal due to improper input sanitization. The provided example uses a crafted `<span>` tag with a malicious `style` attribute to execute arbitrary JavaScript in the context of the affected site.
Description
Validate-before-filter vulnerability in cleanhtml.pl 1.129 in LiveJournal CVS before Dec 7 2005, when the cleancss option is enabled, allows remote attackers to conduct cross-site scripting (XSS) attacks via a "\" (backslash) within a "javascript" scheme in a style property (such as "javas\cript"), which bypasses the "javascript" check before the "\" is stripped and then rendered in web browsers that allow scripting in style sheets.
Exploits (1)
This exploit demonstrates an HTML injection vulnerability in LiveJournal due to improper input sanitization. The provided example uses a crafted `<span>` tag with a malicious `style` attribute to execute arbitrary JavaScript in the context of the affected site.